Hello, why is the syscall -1 special-cased here?
Wouldn't any invalid syscall number such as -2 work equally well, making this whole 'permit' pinned on the -1 value bogus? On Tue, Jul 07, 2026 at 09:06:44PM +0200, Thomas Gleixner wrote: > The return value of that function is boolean and tells the caller whether > to permit the syscall processing or not. > > Rename the function so the purpose is clear and make the return type bool. > > Signed-off-by: Thomas Gleixner <[email protected]> > Cc: Arnd Bergmann <[email protected]> > Cc: Oleg Nesterov <[email protected]> > Cc: Richard Henderson <[email protected]> > Cc: Vineet Gupta <[email protected]> > Cc: Russell King <[email protected]> > Cc: Catalin Marinas <[email protected]> > Cc: Will Deacon <[email protected]> > Cc: Guo Ren <[email protected]> > Cc: Brian Cain <[email protected]> > Cc: Geert Uytterhoeven <[email protected]> > Cc: Michal Simek <[email protected]> > Cc: Thomas Bogendoerfer <[email protected]> > Cc: Dinh Nguyen <[email protected]> > Cc: Helge Deller <[email protected]> > Cc: Yoshinori Sato <[email protected]> > Cc: "David S. Miller" <[email protected]> > Cc: Andreas Larsson <[email protected]> > Cc: Chris Zankel <[email protected]> > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > --- > arch/alpha/kernel/ptrace.c | 2 +- > arch/arc/kernel/ptrace.c | 2 +- > arch/arm/kernel/ptrace.c | 2 +- > arch/arm64/kernel/ptrace.c | 2 +- > arch/csky/kernel/ptrace.c | 2 +- > arch/hexagon/kernel/traps.c | 2 +- > arch/m68k/kernel/ptrace.c | 2 +- > arch/microblaze/kernel/ptrace.c | 2 +- > arch/mips/kernel/ptrace.c | 2 +- > arch/nios2/kernel/ptrace.c | 2 +- > arch/openrisc/kernel/ptrace.c | 2 +- > arch/parisc/kernel/ptrace.c | 10 ++++------ > arch/sh/kernel/ptrace_32.c | 2 +- > arch/sparc/kernel/ptrace_32.c | 2 +- > arch/sparc/kernel/ptrace_64.c | 2 +- > arch/um/kernel/ptrace.c | 2 +- > arch/xtensa/kernel/ptrace.c | 2 +- > include/asm-generic/syscall.h | 4 ++-- > include/linux/entry-common.h | 25 ++++++++++++------------- > include/linux/ptrace.h | 13 ++++++------- > 20 files changed, 40 insertions(+), 44 deletions(-) > > --- a/arch/alpha/kernel/ptrace.c > +++ b/arch/alpha/kernel/ptrace.c > @@ -375,7 +375,7 @@ asmlinkage unsigned long syscall_trace_e > struct pt_regs *regs = current_pt_regs(); > > if (test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs)) { > + !ptrace_report_syscall_permit_entry(regs)) { > syscall_set_nr(current, regs, -1); Why is this done here? Presumably the ptrace_report_syscall_entry returns false here becasue the tracer put -1 into whatever register specifies the syscall number (or it was there to start with) which was then read back, compared to -1, leading to returning false. Now it's set to -1 again? Thanks Michal > if (regs->r19 == 0 && regs->r0 == (unsigned long)-1) > syscall_set_return_value(current, regs, -ENOSYS, 0); > --- a/arch/arc/kernel/ptrace.c > +++ b/arch/arc/kernel/ptrace.c > @@ -342,7 +342,7 @@ long arch_ptrace(struct task_struct *chi > asmlinkage int syscall_trace_enter(struct pt_regs *regs) > { > if (test_thread_flag(TIF_SYSCALL_TRACE)) > - if (ptrace_report_syscall_entry(regs)) > + if (!ptrace_report_syscall_permit_entry(regs)) > return ULONG_MAX; > > #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS > --- a/arch/arm/kernel/ptrace.c > +++ b/arch/arm/kernel/ptrace.c > @@ -840,7 +840,7 @@ static void report_syscall(struct pt_reg > > if (dir == PTRACE_SYSCALL_EXIT) > ptrace_report_syscall_exit(regs, 0); > - else if (ptrace_report_syscall_entry(regs)) > + else if (!ptrace_report_syscall_permit_entry(regs)) > current_thread_info()->abi_syscall = -1; > > regs->ARM_ip = ip; > --- a/arch/arm64/kernel/ptrace.c > +++ b/arch/arm64/kernel/ptrace.c > @@ -2379,7 +2379,7 @@ static int report_syscall_entry(struct p > int regno, ret; > > saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, ®no); > - ret = ptrace_report_syscall_entry(regs); > + ret = !ptrace_report_syscall_permit_entry(regs); > if (ret) > forget_syscall(regs); > regs->regs[regno] = saved_reg; > --- a/arch/csky/kernel/ptrace.c > +++ b/arch/csky/kernel/ptrace.c > @@ -320,7 +320,7 @@ long arch_ptrace(struct task_struct *chi > asmlinkage int syscall_trace_enter(struct pt_regs *regs) > { > if (test_thread_flag(TIF_SYSCALL_TRACE)) > - if (ptrace_report_syscall_entry(regs)) > + if (!ptrace_report_syscall_permit_entry(regs)) > return -1; > > if (!seccomp_permit_syscall()) > --- a/arch/hexagon/kernel/traps.c > +++ b/arch/hexagon/kernel/traps.c > @@ -345,7 +345,7 @@ void do_trap0(struct pt_regs *regs) > > /* allow strace to catch syscall args */ > if (unlikely(test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs))) > + !ptrace_report_syscall_permit_entry(regs))) > return; /* return -ENOSYS somewhere? */ > > /* Interrupts should be re-enabled for syscall processing */ > --- a/arch/m68k/kernel/ptrace.c > +++ b/arch/m68k/kernel/ptrace.c > @@ -279,7 +279,7 @@ asmlinkage int syscall_trace_enter(void) > int ret = 0; > > if (test_thread_flag(TIF_SYSCALL_TRACE)) > - ret = ptrace_report_syscall_entry(task_pt_regs(current)); > + ret = > !ptrace_report_syscall_permit_entry(task_pt_regs(current)); > > if (!seccomp_permit_syscall()) > return -1; > --- a/arch/microblaze/kernel/ptrace.c > +++ b/arch/microblaze/kernel/ptrace.c > @@ -139,7 +139,7 @@ asmlinkage unsigned long do_syscall_trac > secure_computing_strict(regs->r12); > > if (test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs)) > + !ptrace_report_syscall_permit_entry(regs)) > /* > * Tracing decided this syscall should not happen. > * We'll return a bogus call number to get an ENOSYS > --- a/arch/mips/kernel/ptrace.c > +++ b/arch/mips/kernel/ptrace.c > @@ -1324,7 +1324,7 @@ asmlinkage long syscall_trace_enter(stru > user_exit(); > > if (test_thread_flag(TIF_SYSCALL_TRACE)) { > - if (ptrace_report_syscall_entry(regs)) > + if (!ptrace_report_syscall_permit_entry(regs)) > return -1; > } > > --- a/arch/nios2/kernel/ptrace.c > +++ b/arch/nios2/kernel/ptrace.c > @@ -133,7 +133,7 @@ asmlinkage int do_syscall_trace_enter(vo > int ret = 0; > > if (test_thread_flag(TIF_SYSCALL_TRACE)) > - ret = ptrace_report_syscall_entry(task_pt_regs(current)); > + ret = > !ptrace_report_syscall_permit_entry(task_pt_regs(current)); > > return ret; > } > --- a/arch/openrisc/kernel/ptrace.c > +++ b/arch/openrisc/kernel/ptrace.c > @@ -293,7 +293,7 @@ asmlinkage long do_syscall_trace_enter(s > long ret = 0; > > if (test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs)) > + !ptrace_report_syscall_permit_entry(regs)) > /* > * Tracing decided this syscall should not happen. > * We'll return a bogus call number to get an ENOSYS > --- a/arch/parisc/kernel/ptrace.c > +++ b/arch/parisc/kernel/ptrace.c > @@ -326,7 +326,7 @@ long compat_arch_ptrace(struct task_stru > long do_syscall_trace_enter(struct pt_regs *regs) > { > if (test_thread_flag(TIF_SYSCALL_TRACE)) { > - int rc = ptrace_report_syscall_entry(regs); > + bool permit = ptrace_report_syscall_permit_entry(regs); > > /* > * As tracesys_next does not set %r28 to -ENOSYS > @@ -334,12 +334,10 @@ long do_syscall_trace_enter(struct pt_re > */ > regs->gr[28] = -ENOSYS; > > - if (rc) { > + if (!permit) { > /* > - * A nonzero return code from > - * ptrace_report_syscall_entry() tells us > - * to prevent the syscall execution. Skip > - * the syscall call and the syscall restart handling. > + * Skip the syscall call and the syscall restart > + * handling. > * > * Note that the tracer may also just change > * regs->gr[20] to an invalid syscall number, > --- a/arch/sh/kernel/ptrace_32.c > +++ b/arch/sh/kernel/ptrace_32.c > @@ -455,7 +455,7 @@ long arch_ptrace(struct task_struct *chi > asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) > { > if (test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs)) { > + !ptrace_report_syscall_permit_entry(regs)) { > regs->regs[0] = -ENOSYS; > return -1; > } > --- a/arch/sparc/kernel/ptrace_32.c > +++ b/arch/sparc/kernel/ptrace_32.c > @@ -441,7 +441,7 @@ asmlinkage int syscall_trace(struct pt_r > if (syscall_exit_p) > ptrace_report_syscall_exit(regs, 0); > else > - ret = ptrace_report_syscall_entry(regs); > + ret = !ptrace_report_syscall_permit_entry(regs); > } > > return ret; > --- a/arch/sparc/kernel/ptrace_64.c > +++ b/arch/sparc/kernel/ptrace_64.c > @@ -1093,7 +1093,7 @@ asmlinkage int syscall_trace_enter(struc > user_exit(); > > if (test_thread_flag(TIF_SYSCALL_TRACE)) > - ret = ptrace_report_syscall_entry(regs); > + ret = !ptrace_report_syscall_permit_entry(regs); > > if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) > trace_sys_enter(regs, regs->u_regs[UREG_G1]); > --- a/arch/um/kernel/ptrace.c > +++ b/arch/um/kernel/ptrace.c > @@ -135,7 +135,7 @@ int syscall_trace_enter(struct pt_regs * > if (!test_thread_flag(TIF_SYSCALL_TRACE)) > return 0; > > - return ptrace_report_syscall_entry(regs); > + return !ptrace_report_syscall_permit_entry(regs); > } > > void syscall_trace_leave(struct pt_regs *regs) > --- a/arch/xtensa/kernel/ptrace.c > +++ b/arch/xtensa/kernel/ptrace.c > @@ -547,7 +547,7 @@ int do_syscall_trace_enter(struct pt_reg > regs->areg[2] = -ENOSYS; > > if (test_thread_flag(TIF_SYSCALL_TRACE) && > - ptrace_report_syscall_entry(regs)) { > + !ptrace_report_syscall_permit_entry(regs)) { > regs->areg[2] = -ENOSYS; > regs->syscall = NO_SYSCALL; > return 0; > --- a/include/asm-generic/syscall.h > +++ b/include/asm-generic/syscall.h > @@ -58,8 +58,8 @@ void syscall_set_nr(struct task_struct * > * > * It's only valid to call this when @task is stopped for system > * call exit tracing (due to %SYSCALL_WORK_SYSCALL_TRACE or > - * %SYSCALL_WORK_SYSCALL_AUDIT), after ptrace_report_syscall_entry() > - * returned nonzero to prevent the system call from taking place. > + * %SYSCALL_WORK_SYSCALL_AUDIT), after ptrace_report_syscall_permit_entry() > + * returned False to prevent the system call from taking place. > * > * This rolls back the register state in @regs so it's as if the > * system call instruction was a no-op. The registers containing > --- a/include/linux/entry-common.h > +++ b/include/linux/entry-common.h > @@ -38,21 +38,22 @@ > SYSCALL_WORK_SYSCALL_EXIT_TRAP) > > /** > - * arch_ptrace_report_syscall_entry - Architecture specific > ptrace_report_syscall_entry() wrapper > + * arch_ptrace_report_syscall_permit_entry - Architecture specific wrapper > for > + * > ptrace_report_syscall_permit_entry() > * @regs: Pointer to the register state at syscall entry > * > - * Invoked from syscall_trace_enter() to wrap ptrace_report_syscall_entry(). > + * Invoked from syscall_trace_enter() to wrap > ptrace_report_syscall_permit_entry(). > * > - * This allows architecture specific ptrace_report_syscall_entry() > + * This allows architecture specific ptrace_report_syscall_permit_entry() > * implementations. If not defined by the architecture this falls back to > - * to ptrace_report_syscall_entry(). > + * to ptrace_report_syscall_permit_entry(). > */ > -static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs > *regs); > +static __always_inline bool arch_ptrace_report_syscall_permit_entry(struct > pt_regs *regs); > > -#ifndef arch_ptrace_report_syscall_entry > -static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs > *regs) > +#ifndef arch_ptrace_report_syscall_permit_entry > +static __always_inline bool arch_ptrace_report_syscall_permit_entry(struct > pt_regs *regs) > { > - return ptrace_report_syscall_entry(regs); > + return ptrace_report_syscall_permit_entry(regs); > } > #endif > > @@ -73,8 +74,6 @@ static inline void syscall_enter_audit(s > static __always_inline long syscall_trace_enter(struct pt_regs *regs, > unsigned long work, > long syscall) > { > - long ret = 0; > - > /* > * Handle Syscall User Dispatch. This must comes first, since > * the ABI here can be something that doesn't make sense for > @@ -95,8 +94,8 @@ static __always_inline long syscall_trac > > /* Handle ptrace */ > if (work & (SYSCALL_WORK_SYSCALL_TRACE | SYSCALL_WORK_SYSCALL_EMU)) { > - ret = arch_ptrace_report_syscall_entry(regs); > - if (ret || (work & SYSCALL_WORK_SYSCALL_EMU)) > + if (!arch_ptrace_report_syscall_permit_entry(regs) || > + (work & SYSCALL_WORK_SYSCALL_EMU)) > return -1L; > } > > @@ -137,7 +136,7 @@ static __always_inline long syscall_trac > * It handles the following work items: > * > * 1) syscall_work flag dependent invocations of > - * ptrace_report_syscall_entry(), __seccomp_permit_syscall(), > trace_sys_enter() > + * ptrace_report_syscall_permit_entry(), __seccomp_permit_syscall(), > trace_sys_enter() > * 2) Invocation of audit_syscall_entry() > */ > static __always_inline long syscall_enter_from_user_mode_work(struct pt_regs > *regs, long syscall) > --- a/include/linux/ptrace.h > +++ b/include/linux/ptrace.h > @@ -405,13 +405,13 @@ extern void sigaction_compat_abi(struct > /* > * ptrace report for syscall entry and exit looks identical. > */ > -static inline int ptrace_report_syscall(unsigned long message) > +static inline bool ptrace_report_syscall(unsigned long message) > { > int ptrace = current->ptrace; > int signr; > > if (!(ptrace & PT_PTRACED)) > - return 0; > + return true; > > signr = ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0), > message); > @@ -424,11 +424,11 @@ static inline int ptrace_report_syscall( > if (signr) > send_sig(signr, current, 1); > > - return fatal_signal_pending(current); > + return !fatal_signal_pending(current); > } > > /** > - * ptrace_report_syscall_entry - task is about to attempt a system call > + * ptrace_report_syscall_permit_entry - task is about to attempt a system > call > * @regs: user register state of current task > * > * This will be called if %SYSCALL_WORK_SYSCALL_TRACE or > @@ -438,7 +438,7 @@ static inline int ptrace_report_syscall( > * call number and arguments to be tried. It is safe to block here, > * preventing the system call from beginning. > * > - * Returns zero normally, or nonzero if the calling arch code should abort > + * Returns True normally, or False if the calling architecture code should > abort > * the system call. That must prevent normal entry so no system call is > * made. If @task ever returns to user mode after this, its register state > * is unspecified, but should be something harmless like an %ENOSYS error > @@ -447,8 +447,7 @@ static inline int ptrace_report_syscall( > * > * Called without locks, just after entering kernel mode. > */ > -static inline __must_check int ptrace_report_syscall_entry( > - struct pt_regs *regs) > +static inline __must_check bool ptrace_report_syscall_permit_entry(struct > pt_regs *regs) > { > return ptrace_report_syscall(PTRACE_EVENTMSG_SYSCALL_ENTRY); > } >
